[eru]

> What if GitHub’s token scanning service went down.

If it's a secret gist, you only exposed the attacker's key to github, but not to the wider public?

[OJFord]

They mean it went down as in stopped working, had some outage; so you've tried to use it as a token revocation service, but it doesn't work (or not as quickly as you expect).

[eru]

Sure, that's a valid worry. Though that's not all that different from a special purpose public token revocation service: they can also go down.

[OJFord]

True, just more to rely on with the scanning too I suppose.